Link to home
Start Free TrialLog in
Avatar of CASorter
CASorterFlag for United States of America

asked on

qntc security

we have a client that is creating an import file on an AS-400.
if the file stays on the as-400 the processing of the file takes about 2 hours.
if the file is moved to the windows box it takes about 40 minutes.
i have asked them to put the file on the windows box directly,  i am assuming they should/need to use QNTC to accomplish this.
they said this would require changes to their network to accomidate this that would preclude me for getting connected to the windows computers that i need to.

currently the computers i need are in a workgroup inside their firewall.

my question is this,   what kind of authentication/connections are required to implement QNTC to allow the as400 to write to a shared windows folder?

there are also files that i put in this folder that the as400 needs to pick up and process.

if this was implemented, i would not even need to see the as400 from the windows side at all,   all the files would be transferred back and forth in the windows folder.

if someone could point me in the right direction as to how i could proceed that would be great.



(i could run msdos batch programs that pull the files from the as-400 and put them on the windows side, but would rather not have that layer involved if i can help it, one more thing that might not work)
ASKER CERTIFIED SOLUTION
Avatar of Gary Patterson, CISSP
Gary Patterson, CISSP
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of CASorter

ASKER

thanks!   the reason that they didnt want to do option A (my preference) was that they said the destination windows box had to be on the same domain as the as400.

due to the need for remote access to the windows box and restrictions on remote access if a computer is part of the domain, the destination box is part of a workgroup of computers.  

can an as400 be or is an as400 on a windows network?

is it required that the as400 and the windows box be on the same network in order for qntc to work?



we are currently doing a modified option be, where we map a drive to the as400 and process the files directly from there. (we dont actually pull it across)  this is proving to take to long, which is why we are trying to get the files placed on the windows side.


I don't think that I've ever set up QNTC between systems on different Windows domains, but I can't see why not.  You won't see the list of servers and shares when you browse from QNTC (from WRKLNK), but you should still be able to add a link to the system by name or IP address.  The AS/400 will still need rights to the Windows share: either "Everyone" rights or a Windows profile with rights to the share that matches an AS/400 profile name and password, character for character.

An AS/400 can be part of a Windows network.  Specifically, it can share folders and printer using Windows protocols (CIFS - this is called NetServer), and it can access shares on Windows machines using the QNTC file system.  The AS/400 can also be configured to use Windows-based Kerberos authentication for certain functions.  The AS/400 can also access Windows printer shares using the LPR/LPD protocol when Windows File and Print Services for Unix is installed on a Windows system that publishes printer shares.

The AS/400 and the Windows systems do not need to be on the same network, but, of course, a network path between the two systems must exist, and the appropriate ports need to be open if the connections are firewalled.

- Gary Patterson
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
so you guys are saying that we should be able to create the  directory to a computer in a workgroup (as long as the share on the windows machine has everyone access) from the as400, which is part of a secured domain.


simply by doing the ctrdir  command...

can you think of why they might say that being on the same domain was a requirement?

Avatar of Member_2_276102
Member_2_276102

simply by doing...

...and ensuring matching user/password on both ends and running under that profile on the AS/400 (when going outward via /QNTC) and ensuring all "firewalls" (including Windows builtin or Zone Alarm or whatever) allow conversations between the two systems... i.e., do the manual stuff that is outside of overall networking configuration.

It's easy enough to test manually. Once the users exist on both systems, log on to the AS/400 as that user, run CRTDIR to mount the share, and drill into the share with the WRKLNK command. The user will either be able to see the files or won't.

Naturally, if an IP address is non-routable and the route crosses a router that drops the transaction, or if any similar circumstance gets in the way, additional steps would be needed. Anything going across some unknown network environment is always subject to trouble.

Without more info about the end-to-end route, I can't guess what might be an issue in their case. I manage to get cross-domain transactions working, but it's "Windows". You never know what tweaks might be needed.

Tom
I don't know of any reason that "same domain" is a requirement.  Here is the possible source of confusion:

http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=%2Fifs%2Frzaaxntmkdir.htm

- Gary Patterson

BTW, what Windows OS is on the PC? What OS version is on the AS/400?

And Windows fix packs and AS/400 PTFs to match can make big differences, as can exit programs on AS/400 network exit points.

Tom
part of the issue is that i dont have any access at all to the as400.

the as400 programmer i am dealing with has to go through the corporate IT network bureaucracy.  i dont think he has any experience with qntc and is thoruoghly caught in the middle.  

me asking to do this on one side,  and his network people saying cant be done on the other side.

i will see what i can do.

windows server 2008 r2 (64 bit) is the windows side, i dont know what the as400 is.


when i say no access,   i mean    i cant enter any commands... i do have access to the folder on teh as400 that we are currently processing the file in.

i do have access to the folder on teh as400...

What interface is used for that access?

So, you personally have a way to access a folder on the AS/400. But there is a particular PC in the client's network that needs automated access to that same folder. It doesn't matter much if the PC has read/write access to the folder or if the AS/400 pushes content from that folder to the PC, as long as an automated process on the PC can work with data in that folder.

The NetServer configuration on the AS/400 has domain DDDD set. The PC is configured for a workgroup WWW. Because the workgroup does not match the configured NetServer domain, the expectation is that there is no Windows networking connectivity available between the AS/400 and the PC.

Anything significant missing from that?

Tom
back to the original problem...
i *can* run the import directly on the file on the as400..  it takes 2 hours
if i move it to the windows box..  it takes 40 minutes...  same import file, same executable.

i want to have it end up on the windows box.
 i *can* write batch files that pull the file over so the import program can run on it there, but i would rather have them put it there in the first place.  hence the intrest in QNTC and getting them to put it there to begin with
and as to the 2nd part....
what  you have described is correct.
as/400 has domain DDDD
pc (which is server 2008 r2)  is in workgroup WWW

that much i understand and know to be true.
i am not sure what you mean concerning the next sentence.

 Because the workgroup does not match the configured NetServer domain, the expectation is that there is no Windows networking connectivity available between the AS/400 and the PC.

i think  Because the workgroup does not match the configured NetServer domain  is true.

but the expectation part... not sure..  
i DO have ability to read and write to the the folder on the AS/400   we are mapping a windows drive to the as400 IP address and folder  \\10.10.10.133\xfer
i have full read/write access to this as400 folder

which implies that there IS connectivity between the two...

which is why i am scratching my head so much concerning why their network team seems to think there is some domain level imcompatiblity.  i already can get to the folder one way,  seems like they could get to a folder on my box the other way.....
Stating things over again has helped keep focus. Thank you.

...but i would rather have them put it there in the first place.

And back at the beginning:

we have a client that is creating an import file on an AS-400.

So, the file is actually generated on the AS/400? I would normally expect (i.e., "import") this to be a .CSV file from a database, and this becomes an IMPORT file either into another database or something like Excel.

Due to Microsoft's ability to change Windows networking protocols/requirements with service packs, I can understand some reluctance on the part of the AS/400 guys. Some frustration can arise in getting a setup to work reliably and securely from a non-MS platform.

Is there any chance of installing/running MS's NFS on the PC? The AS/400 supports NFS as client and server. But if /QNTC is difficult to set up to reach this PC, NFS might seem an even greater challenge.

Tom
correct.
the as400 is creating a CSV file
this file is being imported via a program running on the windows box.
the issue is where the as400 guys put the file.

on the as400 (slow importing or additional step to move it to the windows box)
or
on the windows box to begin with (fast running, no additional transfer step)


Some frustration can arise in getting a setup to work reliably and securely from a non-MS platform.
um... ya   :(

SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
does qntc need to be installed on the as400 or is it port of the normal setup
*part of the normal setup
AFAIK, the file system QNTC is a core OS component.  Make sure Netserver is started before using QNTC.

- Gary Patterson
Also make sure your share names are less than 12 characters long.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
thanks all.

i dont think the problem has boiled down to a technical one, rather a bureaucratic one.

i think we have supplied them with the tools to accomplish this, it is a matter of them wanting to do it.  


in the meantime i have done the batch files on my side that accomplish the same thing.

thanks for your correspondance!